VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/buger/jsonparser: vulnerability history, versions and safety

github.com/buger/jsonparser is a package in the Go ecosystem. Vulert records 8 vulnerabilities for it across 120 releases, from Apr 2021 to Mar 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
8 vulnerabilities recorded H3 U5
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 18 Mar 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/buger/jsonparser vulnerabilities

Vulert verdict on github.com/buger/jsonparser v1.6.1 i

Updated on 22 Oct 2026

Careful: v1.6.1 has 8 known vulnerabilities, and 2 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Quiet

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.6.1 — affected i
  • Vulnerabilities on record 8 over 4 years · 2 in the last year i
  • Latest disclosure 18 Mar 2026 i
  • Highest CVSS 7.5 i
  • With no published fix 2 i
  • Stars 5,663 i
  • OpenSSF scorecard 3/10 i
  • Last release 2 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/buger/jsonparser, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20260821193342-36a686d11807 21 Aug 2026 H3 U5 MIT No Details →
v1.6.2-0.20260821193342-36a686d11807 21 Aug 2026 H3 U5 MIT No Details →
v0.0.0-20260731041251-6454f95de679 31 Jul 2026 H3 U5 MIT No Details →
v1.6.2-0.20260731041251-6454f95de679 31 Jul 2026 H3 U5 MIT No Details →
v1.6.1 30 Jul 2026 H3 U5 MIT No Details →
v1.6.0 29 Jul 2026 H3 U5 MIT No Details →
v1.5.1 29 Jul 2026 H3 U5 MIT No Details →
v1.5.1-0.20260728143752-ae21251eac63 28 Jul 2026 H3 U5 MIT No Details →
v1.5.0 28 Jul 2026 H3 U5 MIT No Details →
v1.4.1-0.20260728110826-ebb4a3afa7cc 28 Jul 2026 H3 U5 MIT No Details →
v1.4.0 28 Jul 2026 H3 U5 MIT No Details →
v1.3.1 28 Jul 2026 H3 U5 MIT No Details →
v1.3.0 27 Jul 2026 H3 U5 MIT No Details →
v1.2.1-0.20260726165527-f26958f942dc 26 Jul 2026 H3 U5 MIT No Details →
v0.0.0-20260429054943-c172c166bb09 29 Apr 2026 H3 U5 MIT No Details →
v1.2.0 29 Apr 2026 H3 U5 MIT No Details →
v0.0.0-20260319124758-a69e7e01cd4a 19 Mar 2026 H3 U5 MIT No Details →
v1.1.2 19 Mar 2026 H3 U5 MIT No Details →
v1.1.2-0.20260318063754-d3eacc0bab77 18 Mar 2026 H3 U5 MIT No Details →
v1.1.2-0.20240311173931-768145b80178 11 Mar 2024 H3 U5 MIT No Details →
v0.0.0-20220418200129-61b32cfdfa0f 18 Apr 2022 H3 U5 MIT No Details →
v1.1.2-0.20220418200129-61b32cfdfa0f 18 Apr 2022 H3 U5 MIT No Details →
v1.1.2-0.20220418200020-2181e8398f18 18 Apr 2022 H3 U5 MIT No Details →
v1.1.2-0.20220418175908-1510b5194182 18 Apr 2022 H3 U5 MIT No Details →
v1.1.2-0.20220212131229-6fc2e488ed3c 12 Feb 2022 H3 U5 MIT No Details →
v0.0.0-20211125204129-a6f867eb7787 25 Nov 2021 H3 U5 MIT No Details →
v1.1.2-0.20211125204129-a6f867eb7787 25 Nov 2021 H3 U5 MIT No Details →
v1.1.2-0.20211125105359-cbc01fdbbe13 25 Nov 2021 H3 U5 MIT No Details →
v0.0.0-20210620171241-dc92d6932a12 20 Jun 2021 H3 U5 MIT No Details →
v1.1.2-0.20210620171241-dc92d6932a12 20 Jun 2021 H3 U5 MIT No Details →
v1.1.2-0.20210620171128-2d9d6343e862 20 Jun 2021 H3 U5 MIT No Details →
v1.1.2-0.20210511173321-608d8c5d4a80 11 May 2021 H3 U5 MIT No Details →
v0.0.0-20210414060732-09bcf22e90f4 14 Apr 2021 H3 U5 MIT No Details →
v1.1.2-0.20210414060732-09bcf22e90f4 14 Apr 2021 H3 U5 MIT No Details →
v1.1.2-0.20210413111829-51af27e10dd3 13 Apr 2021 H3 U5 MIT No Details →
v0.0.0-20210402111052-a0c6c18bdd14 02 Apr 2021 H3 U5 MIT No Details →
v1.1.2-0.20210402111052-a0c6c18bdd14 02 Apr 2021 H3 U5 MIT No Details →
v1.1.2-0.20210323142705-817f6399c14b 23 Mar 2021 H3 U5 MIT No Details →
v1.1.2-0.20210319182348-bf062a194c49 19 Mar 2021 H3 U5 MIT No Details →
v1.1.2-0.20210319164016-40b56a14a65b 19 Mar 2021 H3 U5 MIT No Details →
v1.0.1-0.20210122175133-275f2e856c91 22 Jan 2021 H3 U5 MIT No Details →
v1.1.2-0.20210122175133-275f2e856c91 22 Jan 2021 H3 U5 MIT No Details →
v1.1.2-0.20210108094449-702655df0c5c 08 Jan 2021 H3 U5 MIT No Details →
v0.0.0-20210108093736-df3ea76ece10 08 Jan 2021 H3 U5 MIT No Details →
v1.1.1 08 Jan 2021 H3 U5 MIT No Details →
v1.1.1-0.20210107090837-392c71613130 07 Jan 2021 H3 U5 MIT No Details →
v1.1.1-0.20210104184447-449b024228e2 04 Jan 2021 H3 U5 MIT No Details →
v1.1.0 24 Dec 2020 H3 U5 MIT No Details →
v1.0.1-0.20201223005033-1e1db9eaebb2 23 Dec 2020 H3 U5 MIT No Details →
v1.0.1-0.20201223005006-d15cedbda55d 23 Dec 2020 H3 U5 MIT No Details →
v1.0.1-0.20201222153515-9b2f299766f5 22 Dec 2020 H3 U5 MIT No Details →
v1.0.1-0.20201219190157-ee298179cc5d 19 Dec 2020 H3 U5 MIT No Details →
v1.0.1-0.20201124173947-26b93019f65b 24 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201124162613-93ae43c6a729 24 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201124065608-1239415cee20 24 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201124065521-71a899e0dc2d 24 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201124065453-94ddf53e60db 24 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201124065407-49146d0820a3 24 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201117215455-aa3d476efa34 17 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201117214130-837dfaa128f2 17 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201103104334-3980c9c9b991 03 Nov 2020 H3 U5 MIT No Details →
v1.0.1-0.20201007071413-dad77a892926 07 Oct 2020 H3 U5 MIT No Details →
v1.0.1-0.20200730151825-cb835d480ac5 30 Jul 2020 H3 U5 MIT No Details →
v0.0.0-20200616181944-250c37f3d676 16 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200616181944-250c37f3d676 16 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200615092824-63af0e0b6f30 15 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200604061816-8d8f38bcce99 04 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200603181208-ae587ef450ef 03 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200603061736-4eafe9bec067 03 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200603061501-84562f4bb9c1 03 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200603061437-9c478dc7f598 03 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200602134829-028d81d88bd3 02 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200602133603-8dad4bb609d7 02 Jun 2020 H3 U5 MIT No Details →
v1.0.1-0.20200529235929-a04c0ece70b4 29 May 2020 H3 U5 MIT No Details →
v1.0.1-0.20200528031959-277c1bf2e485 28 May 2020 H3 U5 MIT No Details →
v1.0.1-0.20200522083434-69104e2c5db4 22 May 2020 H3 U5 MIT No Details →
v0.0.0-20200510021239-5754b3eaeae7 10 May 2020 H3 U5 MIT No Details →
v1.0.0 10 May 2020 H3 U5 MIT No Details →
v0.0.0-20200510021030-57853d84bf60 10 May 2020 H3 U5 MIT No Details →
v0.0.0-20200510020711-3fdec1a24f02 10 May 2020 H3 U5 MIT No Details →
v0.0.0-20200510020142-47da132694be 10 May 2020 H3 U5 MIT No Details →
v0.0.0-20200507200006-c912c6b9a0a4 07 May 2020 H3 U5 MIT No Details →
v0.0.0-20200507195752-1f477a0564bb 07 May 2020 H3 U5 MIT No Details →
v0.0.0-20200507195458-9cbc7bd89d76 07 May 2020 H3 U5 MIT No Details →
v0.0.0-20200507192316-8efa2fa20433 07 May 2020 H3 U5 MIT No Details →
v0.0.0-20200403065753-b10e032685b0 03 Apr 2020 H3 U5 MIT No Details →
v0.0.0-20200330065611-5d321b4534c9 30 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200324034626-74af0255a7ca 24 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200323121524-37674dba7176 23 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200323120224-50f9457fdcd8 23 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200322175846-f7e751efca13 22 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200322115454-86818d0ebf39 22 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200321185624-cc7baf76336a 21 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200321185520-11fa7e42322d 21 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200321185427-111244564385 21 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200321185410-91ac96899e49 21 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20200312023001-2e826edb6fd7 12 Mar 2020 H3 U5 MIT No Details →
v0.0.0-20191204142016-1a29609e0929 04 Dec 2019 H3 U5 MIT No Details →
v0.0.0-20191004114745-ee4c978eae7e 04 Oct 2019 H3 U5 MIT No Details →
v0.0.0-20191004114704-7c4dc079a36a 04 Oct 2019 H3 U5 MIT No Details →
v0.0.0-20191004114647-9a982e5282f3 04 Oct 2019 H3 U5 — No Details →
v0.0.0-20191004114632-34606305661a 04 Oct 2019 H3 U5 — No Details →
v0.0.0-20181115193947-bf1c66bbce23 15 Nov 2018 H3 U5 — No Details →
v0.0.0-20181023193515-52c6e1462ebd 23 Oct 2018 H3 U5 — No Details →
v0.0.0-20180910192245-6acdf747ae99 10 Sep 2018 H3 U5 — No Details →
v0.0.0-20180808090653-f4dd9f5a6b44 08 Aug 2018 H3 U5 — No Details →
v0.0.0-20180318095312-2cac668e8456 18 Mar 2018 H3 U5 — No Details →
v0.0.0-20180314112006-521e3e77693f 14 Mar 2018 H3 U5 — No Details →
v0.0.0-20180307132322-6046d9271ada 07 Mar 2018 H3 U5 — No Details →
v0.0.0-20180131123142-4be68c93a244 31 Jan 2018 H3 U5 — No Details →
v0.0.0-20171014094326-5096fddd2cca 14 Oct 2017 H3 U5 — No Details →
v0.0.0-20171013164540-2b2103c3534e 13 Oct 2017 H3 U5 — No Details →
v0.0.0-20171013164402-812fd63996a5 13 Oct 2017 H3 U5 — No Details →
v0.0.0-20170803100442-fda8192cc4f1 03 Aug 2017 H3 U5 — No Details →
v0.0.0-20170803095956-ef3110938498 03 Aug 2017 H3 U5 — No Details →
v0.0.0-20170727185906-8e4b7e09b0d6 27 Jul 2017 H3 U5 — No Details →
v0.0.0-20170727182249-c6caba88342c 27 Jul 2017 H3 U5 — No Details →
v0.0.0-20170705172143-9addec9710dc 05 Jul 2017 H3 U5 — No Details →
v0.0.0-20170705165425-5ef65f4ccd39 05 Jul 2017 H3 U5 — No Details →
v0.0.0-20170630210052-d79e32088b0d 30 Jun 2017 H3 U5 — No Details →

The newest 120 of 311 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 5
  • 2022 1
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 8 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/buger/jsonparser

The 5 most severe of 8 vulnerabilities recorded for this package

Search all 8 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2020-35381: Denial of Service in jsonparser 7.5 high 1.1.1 25 May 2022
CVE-2020-10675: Infinite Loop in jsonparser 7.5 high 1.0.0 18 May 2021
Denial of Service Vulnerability in github.com/buger/jsonparser 7.5 high No fix published 18 Mar 2026
CVE-2020-35381: Denial of Service in jsonparser N/A unrated 1.1.1 14 Apr 2021
CVE-2020-10675: Infinite Loop in jsonparser N/A unrated 1.0.0 14 Apr 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/buger/jsonparser

Is github.com/buger/jsonparser safe to use?

Vulert records 8 vulnerabilities for github.com/buger/jsonparser in Go: 0 critical, 3 high, 0 medium and 0 low, plus 5 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/buger/jsonparser's Vulert package health score?

Vulert scores github.com/buger/jsonparser 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/buger/jsonparser affected?

Yes. v1.6.1, the version you would install today, has 8 known vulnerabilities, and 2 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/buger/jsonparser should I use?

v1.6.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/buger/jsonparser have?

8 vulnerabilities are recorded for github.com/buger/jsonparser in the Go ecosystem: 0 critical, 3 high, 0 medium and 0 low, plus 5 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/buger/jsonparser vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/buger/jsonparser in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/buger/jsonparser are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/buger/jsonparser for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/buger/jsonparser version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.